CVE-2022-50422 in Linux
Summary
by MITRE • 10/01/2025
In the Linux kernel, the following vulnerability has been resolved:
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete "slow_task->timer". However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below:
(thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE
Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the "task->slow_task" is deallocated.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/03/2026
The vulnerability CVE-2022-50422 represents a critical use-after-free condition in the Linux kernel's SCSI subsystem, specifically within the libsas library that handles serial attached SCSI protocols. This flaw exists in the smp_execute_task_sg() function which manages SMP (SCSI Management Protocol) task execution. The issue manifests when an SMP task execution fails, creating a race condition between the main execution thread and the timer handler thread that can result in memory corruption and potential privilege escalation.
The technical implementation of this vulnerability stems from improper synchronization between the timer deletion mechanism and the timer handler execution. When smp_execute_task_sg() encounters a failed SMP task, it attempts to clean up by calling del_timer() to remove the slow_task->timer. However, this operation does not guarantee that the timer handler sas_task_internal_timedout() has completed execution. The race condition occurs because del_timer() only prevents future timer expirations but does not wait for any currently executing timer handler to finish. This creates a window where the timer handler can continue executing and attempt to access memory that has already been freed by the main cleanup process.
The operational impact of this vulnerability is significant as it can lead to system instability, potential privilege escalation, and denial of service conditions. An attacker who can trigger a failed SMP task execution could potentially exploit this race condition to execute arbitrary code with kernel privileges. The vulnerability directly maps to CWE-416, which describes the use of freed memory condition, and aligns with ATT&CK technique T1068, which covers the exploitation of privilege escalation vulnerabilities. The flaw affects systems running Linux kernels with the libsas SCSI subsystem and can be particularly dangerous in server environments where SCSI storage is heavily utilized.
The fix implemented addresses this vulnerability by replacing del_timer() with del_timer_sync() in the smp_execute_task_sg() function. This change ensures that the timer handler completes execution before any memory deallocation occurs, eliminating the race condition. The del_timer_sync() function provides the necessary synchronization guarantee by waiting for any currently executing timer handler to finish before proceeding with the cleanup. This remediation approach follows established best practices for preventing use-after-free vulnerabilities in kernel code and aligns with security recommendations from the Linux kernel security team. The fix ensures proper memory management and prevents the scenario where the timer handler attempts to access freed memory structures, thereby maintaining system stability and security.